Loading...
A practical guide to testing common authentication and session-related vulnerabilities in modern web applications. Session flaws, token mismanagement, logic bugs, and account takeover techniques.
A practical guide to testing common authentication and session-related vulnerabilities in modern web applications.Create an account → Login from two browsers → Change password in Browser A → Refresh Browser BImpact: An attacker with a stolen session can maintain access even after the victim changes their password.Login → Copy session cookies (EditThisCookie / Cookie Editor) → Logout → Restore copied cookies → RefreshImpact: Stolen cookies can be reused indefinitely.Register with Email A (don't verify) → Change email to Email B → Verify Email B → Change back to Email AImpact: Attackers may verify emails they do not own, leading to account abuse.Register with Email A → Receive verification link → Change email to Email B → Click old linkImpact: Pre-account takeover, Domain verification bypass, Account abuseRequest Reset Link 1 → Request Reset Link 2 → Use Link 1 (still works → persistence)Request reset → Change password → Revisit same reset link (still works → reuse)Impact: Attackers can reuse leaked or older reset URLs for account takeover.Login → Intercept profile update in Burp Suite → Logout → Replay intercepted requestImpact: Attackers may perform actions after logout using captured requests.Visit login page → Record session ID → Login → Check if session ID changedImpact: Attackers can predefine session IDs and hijack accounts after victim logs in.Login on Browser A → Login on Browser B → Check if Browser A is terminatedUse Burp Intruder with parallel login requests to bypass concurrent limitsImpact: Attackers may remain hidden while victims actively use the account.Login as normal user → Record session ID → Upgrade privileges → Check if session changedImpact: Attackers with stolen sessions inherit elevated privileges.Login → Save session cookie → Wait hours or days → Reuse same cookieImpact: Attackers may maintain long-term access without re-authentication.Enable 'Remember Me' → Save token → Logout → Restore tokenImpact: Persistent unauthorized access if token is stolen.Login and capture JWT → Logout → Replay token using Burp Suite or PostmanImpact: JWTs become permanent access keys. No server-side blacklist or expiry check.Weak session management is one of the most common causes of account takeover. Simple implementation mistakes can lead to persistent access, token abuse, session hijacking, privilege escalation, and full account compromise.Industry-standard proxy for intercepting and testing session handling
Online JWT decoder and debugger for token inspection
Browser extension for managing and manipulating cookies
Comprehensive guide to authentication and session vulnerabilities